The monthly systems-and-safety review at a mid-sized hospital network usually runs to forty slides. Last September, the quality chief cut it to seven numbers, projected on the same screen the morbidity meetings use, and the argument that followed was the healthiest the IT department had ever witnessed. The numbers come from the worked September example published by the Ops Atlas — the reference project that gives SecOps its working definition, a contract binding security with operations — and this post retells them the way they landed in that meeting room, because numbers only change behaviour when someone stands up and defends them. Seven numbers, seven small stories, one scoreboard worth stealing for any hospital IT committee.
1. The 82.5% that opened the meeting
First slide, and it looked like a victory lap: 198 of 240 remediation items closed on time, or 82.5% overall. The IT director had half a mind to stop there. The quality chief did not hire him to stop there. An average, she said, is a way of not looking at anything in particular — and she asked for the cut that NIST effectively demands, since NIST dismisses the classic estate-wide number, the “percent patched” figure, as not actionable. What the cells said next is the reason this post exists.
2. Two SecOps cells, twenty points apart
Same estate, same month: internet-facing systems at high urgency ran at 95% on time. The datacentre’s high-urgency cell ran at 75%. Nothing about the staff, the tools, or the workload explained twenty points. One thing did: the datacentre’s change window kept slipping, so the work had nowhere to land. The room understood the lesson without help — a deadline only works when the calendar gives it a home, and the facility-grade discipline that fills the cardiac ICU guidelines this network already runs by applies to servers just as it does to ventilators. Twenty points, one meeting, one protected slot on the change calendar: the cell crossed the line within two months, which is the fastest cultural win the IT department can remember.
3. The 18 findings nobody owned
Third number: 600 open findings, 18 of them with no owner attached. Three percent sounds forgiving until you ask what a finding with no owner is — not a slow fix, but a fix that will never happen, because a ticket without a name is a hope, not a plan. The atlas’s contract language is blunt on this point: one queue, every item owned and dated. The network’s response was to print the ownerless list weekly until the number hit zero, which took five weeks and no money whatsoever — the cheapest quality improvement the committee had ever approved, and the only one nobody tried to adjourn.
4. Six exceptions living past their review date
Fourth: of 35 approved exceptions, 6 had drifted past their review dates — seventeen percent of the exception book running on hope and muscle memory. Exceptions are legitimate clinical tools; a leased imaging workstation that cannot take a hardening setting is real life. But an exception is a loan, not a gift, and the register now counts the overdue ones in the monthly pack, next to the unowned count. Loans, the quality chief noted, get repaid; gifts quietly become furniture.
5. Ninety-six point two five percent telemetry, and a subsidiary nobody scanned
Fifth: 1,540 of 1,600 machines reporting telemetry, or 96.25%. Good number, almost excellent. The sixty silent machines were all one thing — an acquired subsidiary whose estate had never been onboarded for scanning. The room’s collective shrug was the point of the slide: coverage numbers are how an estate admits what it cannot see. A hospital that cannot see a ward cannot treat it; an IT estate that cannot see sixty machines cannot secure them, whatever the percentage says. The subsidiary’s onboarding went onto the register with an owner and a date that same afternoon — the meeting’s only unanimous vote.
6. Three outages out of 120 SecOps changes
Sixth, the counter-metric nobody tracks until it is too late: disruption caused by security work itself. Three incidents in 120 changes, or 2.5% — and all three led back to one estate-wide baseline that was pushed with no pilot ring. The incident review took one sentence: big-bang hardening is not diligence, it is improvisation with paperwork. Ring-by-ring staging, log-only first, went into policy the same afternoon, and the monitoring stack got its overdue thanks, since the advanced heart monitoring technology mindset — watch continuously, intervene early — is the same one that makes telemetry worth funding rather than resenting.
7. The empty list that closed the meeting
Seventh number was not from September at all. The IT director closed with the Netlogon precedent: Microsoft’s CVE-2020-1472 campaign ran enforcement in phases from 11 August 2020, logged denied and permitted connections separately (events 5827, 5828, 5829, 5830, 5831), and held the irreversible step until 9 February 2021 — with one success condition: the exception list empty before the deadline. An empty list, he argued, is the most honest scoreboard security work has ever produced, because nobody can decorate it, inflate it, or argue it into a better shape. The board asked for the network’s own equivalent lists — ownerless findings, stale exceptions, unscanned machines — on one page each month. That page is now the meeting, and the forty-slide deck has quietly retired to a drawer with the fax machine.
What a hospital committee should copy from this SecOps pack
For any clinical governance group wanting the same seven-number discipline, the starter set fits on an index card:
- On-time percentage per cell (asset importance multiplied by urgency), never one estate-wide figure.
- Count of findings with no owner, printed weekly.
- Count of exceptions past their review date.
- Telemetry coverage, with every silent machine named.
- Disruption caused by security changes, so hardening never becomes its own incident.
The worked example, its arithmetic, and the contract language behind it are laid out in the Atlas’s SecOps entry. And for committees that want the cultural argument — numbers over anecdotes, staging over heroics — it is the same argument families hear in cardiac ICU guidelines for patients and families and the same discipline that makes transparent cost comparison possible: write the criteria down, publish the numbers, and let the numbers run the meeting. Forty slides became seven. Nobody missed the other thirty-three.